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Technical Assistance on Student Privacy for 


State and Local Educational Agencies When 
Administering College Admissions Examinations 


About PTAC 


The U.S. Department of Education established the Privacy Technical Assistance Center (PTAC) as a 
“one-stop” resource for education stakeholders to learn about data privacy, confidentiality, and security 
practices related to student-level longitudinal data systems and other uses of student data. PTAC 
provides timely information and updated guidance through a variety of resources, including training 
materials and opportunities to receive direct assistance with privacy, security, and confidentiality of 
student data systems. More PTAC information is available at https://studentprivacy.ed.gov. PTAC 
welcomes input on this document and suggestions for future technical assistance resources relating to 
student privacy. Comments and suggestions can be sent to PrivacyTA@ed.gov. 


Background 


Until recently, most students who took the SAT and ACT (collectively, “college admissions 
examinations” or “exams’) registered for the exams directly (by themselves or with their parents) 
through the College Board and ACT, Inc. (collectively, “testing companies”), independently from the 
schools that they attended. Increasingly, however, schools have begun to register their students for 
these exams. Two trends account for this. First, while some State educational agencies (SEAs) and local 
educational agencies (LEAs) (i.e., school districts) have been administering college admissions 
examinations for many years, an increasing number of SEAs and LEAs are now electing to pay for all 
students to take the college admissions examinations as part of SEA and LEA college access efforts. 
Second, some States are choosing to administer these college admissions examinations to high school 
students to meet the requirement to administer an assessment in reading/language arts and mathematics 
at least once in grades 9-12 under Title I, Part A of the Elementary and Secondary Education Act of 
1965, as amended (ESEA).! 


In connection with these college admissions examinations, testing companies administer voluntary pre- 
test surveys asking questions about a variety of topics ranging from academic interests, to participation 
in extra-curricular activities, to religious affiliation. We have heard from teachers and students, however, 
that the voluntary nature of these pre-test surveys is not well understood, and that each of the 
questions requires a response, and the student must affirmatively indicate in response to multiple 
questions that the student does not wish to provide the information. The survey’s multiple questions are 
designed to allow targeted recruitment, and students are specifically asked whether they would like to 
receive materials from different organizations, including colleges and scholarship organizations. For 
students who consent to being contacted by these organizations, the testing companies then sell this 
information to colleges, universities, scholarship services, and other organizations for college 
recruitment and scholarship solicitation. 


The administration of these tests and the associated pre-test surveys by SEAs and LEAs to students 
raises potential issues under the Family Educational Rights and Privacy Act (FERPA), the confidentiality of 


' http://www.edweek.org/ew/section/multimedia/states-require-students-take-sat-or-act.html 
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information provisions in the Individuals with Disabilities Education Act (IDEA), the Protection of Pupil 
Rights Amendment (PPRA), and several recently enacted State privacy laws, and generally raises 
concerns about privacy best practices.2 The U. S. Department of Education (Department), Privacy 
Technical Assistance Center (PTAC) is issuing this technical assistance document to remind SEAs and 
LEAs of their responsibilities under FERPA, IDEA, and PPRA, and to provide best practice 
recommendations for protecting student privacy when contracting to administer these examinations. It 
should be noted that, while this document is intended to address privacy issues related specifically to the 
administration of college admissions examinations, many of the requirements and recommendations 
discussed herein are also relevant to examinations and surveys administered by third parties more 
generally. 


The Department has determined that this document is significant guidance under the Office of 
Management and Budget’s Final Bulletin for Agency Good Guidance Practices, 72 Fed. Reg. 3432 
(January 25, 2007). See https://www.federalregister.gov/documents/2007/0 |/25/E7-|066/final-bulletin-for- 
agency-good-guidance-practices. Significant guidance is non-binding and does not create or impose new 
legal requirements. The Department is issuing this guidance to provide SEAs and LEAs with information 
to assist them in meeting their obligations under FERPA, IDEA, and PPRA, and the implementing 
regulations at 34 CFR §99, 34 CFR §§ 300.610-300.626, and 34 CFR §98. 


If you are interested in commenting on this guidance, please email us your comment at 
PrivacyTA@ed.gov or write to us at the following address: 


U.S. Department of Education 
Office of the Chief Privacy Officer 
Office of Management 

400 Maryland Ave, SW 
Washington, DC 20202 


For further information about the Department’s guidance processes, please visit 


https://www?2.ed.gov/policy/gen/guid/significant-guidance.html. 


Legal Analysis 


Traditionally, students have independently registered with testing companies and paid to take 
college admissions examinations. Currently, students 13 years or older and parents can register 
online for these exams. This approach does not raise FERPA, IDEA, or PPRA issues because these 
testing companies are not acting on behalf of any educational agency or institution, nor are they 
maintaining any student education records collected as part of the testing process. 


> This document primarily addresses privacy requirements under FERPA, IDEA, and PPRA when SEAs and LEAs 
administer the SAT and ACT as part of the State’s assessment system. It does not address other applicable 
requirements under ESEA, IDEA, Section 504 of the Rehabilitation Act, Title Il of the Americans with Disabilities 
Act, and other civil rights laws. For example, it does not address applicable requirements when students with 
disabilities need appropriate accommodations to participate in these assessments. 
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ESEA 


However, under Title I, Part A of the ESEA, as amended by the No Child Left Behind Act of 2001 
(NCLB) and the Every Student Succeeds Act (ESSA), SEAs are required to administer an 
assessment at least once in grades 9-12 in reading/language arts and mathematics (ESEA section 
1111 (b)(2)(B)(v)(I1)(bb)), and IDEA requires that students with disabilities participate in these 
statewide assessments (IDEA section 612(a)(16)(A)). ESSA also includes new provisions that grant 
SEAs discretion to allow LEAs to administer in high school a nationally recognized high school 
assessment in lieu of the statewide assessment (ESEA section | 111 (b)(2)(H)). The Department’s 
2016 Title | assessment regulations (34 CFR § 200.3) define “nationally recognized high school 
assessment” in a manner that would permit college admissions examinations to be administered 
by LEAs for this purpose, provided that they meet other requirements identified in the ESEA and 
the Department’s implementing regulations. As such, a number of SEAs and LEAs have chosen, or 
may choose, to administer college admissions examinations statewide to high school students to 
implement these provisions. 


FERPA 


FERPA is a Federal law that protects the privacy of student “education records.” The law applies 
to all educational agencies and institutions that receive funds under any program administered by 
the Secretary of Education (20 U.S.C. 1232g(a)(3); 34 CFR § 99.1 (a)). FERPA is implicated, 
whether the college admissions examinations are administered by an LEA directly, or by an LEA at 
the direction of an SEA, if the LEA or SEA discloses personally identifiable information (PII) from 
education records to the testing companies. Standard practice for the administration of these 
college admissions examinations by SEAs and LEAs involves the disclosure of PII from students’ 
education records by an SEA or LEA to the testing companies to register students for the 
assessment, and to generate bar codes that will be attached to any printed exam materials. Pll 
provided for this purpose typically includes, at a minimum, the student’s name, date of birth, 
grade, and gender.? Section | 11 1(i) of the ESEA provides that: “[i]nformation collected or 
disseminated under this section ... shall be collected and disseminated in a manner that protects 
the privacy of individuals consistent with [FERPA].” 


IDEA 


IDEA is a Federal law that protects the rights of students with disabilities. Under IDEA Part B, an 
SEA is required to enforce all Part B requirements, including the Part B Confidentiality of 
Information requirements 20 U.S.C. 1412(a)(8). Part B of the IDEA is also implicated because it 


3 See, e.g., http://www.michigan.gov/documents/micontractconnect/5500079_485075_7.pdf, Page 34 (College 
Board) and 
http://www.act.org/content/dam/act/unsecured/documents/SDUFileLayoutLoadInstructionsSandD.pdf (ACT). 
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includes confidentiality provisions similar to, but broader than, FERPA to protect the privacy of 
children with disabilities (20 U.S.C. 1417(c) and 34 CFR §§ 300.610-300.626). These IDEA 
confidentiality provisions contain informed parent consent and notice provisions that are separate 
from FERPA. These IDEA provisions also prohibit the unauthorized disclosure and use of PIl from 
the education records of students with disabilities, consistent with FERPA. Thus, if parent consent 
is required under FERPA to disclose Pll from students’ education records, and if a student is 
covered under IDEA, parent consent would also be required under IDEA to disclose PIl in 
education records collected, maintained, or used under Part B of the IDEA. 


PPRA 


The testing companies include voluntary surveys as part of the testing packages that they provide 
to schools. These surveys do not impact the test scores, but the testing companies use completed 
surveys to develop tailored lists of students, which the testing companies then sell to institutions 
of higher education (IHEs), scholarship organizations, and other organizations for them to use for 
college recruitment and scholarship solicitation purposes. The administration or distribution by 
LEAs of third-party surveys and surveys that ask students to reveal certain types of sensitive 
information implicates PPRA. LEAs have certain responsibilities under PPRA whenever these pre- 
test surveys are administered or distributed as a school activity. These responsibilities are 
discussed in more detail below. 


Disclosure and Re-Disclosure of PII from Education Records under FERPA and IDEA 


Under FERPA, a parent or an eligible student* generally must provide a signed and dated written 
consent before an educational agency or institution discloses the student’s education records or 
PII contained therein (20 U.S.C. 1232g(b)(1) and (b)(2); 34 CFR § 99.30). FERPA defines 
“education records,” subject to specific exceptions, to mean those records that are: (I) directly 
related to a student, and (2) maintained by an educational agency or institution or by a party 
acting for the agency or institution (20 U.S.C. 1232g(a)(4)(A); 34 CFR § 99.3). FERPA requires 
written consent from the parent or eligible student before disclosing Pll from education records, 
subject to certain exceptions (see 20 U.S.C. 1232g(b), (h), (i), and (j); and 34 CFR § 99.31). 


The IDEA regulations (34 CFR §§ 300.610 through 300.626) identify the confidentiality 
requirements that apply to students with disabilities. These regulations protect the PIl in 
education records collected, maintained, or used under Part B of the IDEA. Under 34 CFR § 
300.622(a), parental consent must be obtained before PIl is disclosed to parties, other than 
officials of participating agencies, unless the information is contained in education records and one 


* An eligible student is one who is at least 18 years of age, or who has enrolled in a postsecondary institution at 
any age. (34 CFR § 99.3 “Eligible Student”) 
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of the FERPA exceptions to consent applies.5 Under IDEA, the definition of “education records” 
is consistent with FERPA. 


Contracts between testing companies and SEA, LEAs, or schools for testing, including testing 
required by the ESEA, as amended, should include provisions assuring that before PIl is disclosed 
nonconsensually, the testing companies (when acting on behalf of the SEA, LEA, or school) will 
comply with the privacy protections required by Federal law, specifically FERPA and 

IDEA. Additionally, if PIl is being exchanged pursuant to a testing contract for the purpose of 
requesting, considering, or granting testing accommodations requests for children with disabilities, 
the testing companies must comply with the privacy protections under the IDEA. When 
contracting with the testing companies, SEAs, LEAs, and schools should also specify in their 
contracts that there is a general prohibition under both FERPA and IDEA regarding the 
unauthorized use and re-disclosure of Pll from students’ education records (including any 
biographical or demographic information about the students provided by the SEA, LEA, or school 
to the testing companies, and the students’ test scores or test score ranges). 


Exceptions to Consent 


There are three exceptions to consent in FERPA (and IDEA) that may apply to the disclosure of 
PII from students’ education records to testing companies in the context of administration of Title 
| assessments. It may be permissible to disclose Pll from students’ education records to the 
testing companies under these three exceptions: 


(1) By SEAs and LEAs under the audit and evaluation exception to consent (20 U.S.C. 
1232g(b)(1)(C), (b)(3), and (b)(5); 34 CFR §§ 99.31 (a)(3) and 99.35) 


(2) By SEAs and LEAs under the studies exception to consent (20 U.S.C. 1232g(b)(1)(F); 34 
CFR § 99.31 (a)(6)); and 


(3) By LEAs under the school official exception to consent (34 CFR §99.31(a)(1)). 


Audit/Evaluation Exception 


FERPA’s audit and evaluation exception permits an LEA or SEA (in its capacity, respectively, as a 
local or State educational authority) to disclose, without the prior, written consent of parents or 
eligible students, Pll from education records to a third party that it has designated as its 
“authorized representative” in connection with an audit or evaluation of Federal- or State- 
supported education programs. Under this exception, the State or local educational authority is 
responsible for using reasonable methods to ensure, to the greatest extent practicable, that its 
authorized representative only uses the PIl to carry out an audit or evaluation of a Federal- or 


° Under IDEA, a participating agency is any agency or institution that collects, maintains, or uses PII, or from which 
PII is obtained, under Part B of the Act (34 CFR § 300.611(c)). 
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State-supported education program, protects the PIl from further unauthorized disclosure or use, 
and destroys the Pll when no longer needed to perform the audit or evaluation. Furthermore, the 
educational authority must enter into a written agreement with the third party, designating the 
third party as the educational authority’s authorized representative and containing the following 
additional information required under 34 CFR § 99.35(a)(3): 


- Specification of the PII from education records to be disclosed; 


- Description of the purpose for which the disclosure of Pll is being made and how the PIl 
will be used (e.g., to administer a Title | assessment), with sufficient specificity to make 
clear that the use is permissible under 34 CFR § 99.31 (a)(3); 


- Requirements for the authorized representative to destroy the PIl when the information 
is no longer needed for the purpose for which it was disclosed, along with a time period 
in which the PII must be destroyed; and 


- Policies and procedures for protecting the Pll from further disclosure and unauthorized 
use (including protecting the Pll from further disclosure by testing companies to any third 
party organization, unless the LEA or SEA authorize the testing company to redisclose the 
PIl to the third party organization and its re-disclosure to the third party organization is 
otherwise permitted by FERPA). 


Studies Exception 


FERPA’s studies exception also permits an LEA or SEA to disclose, without the prior, written 
consent of parents or eligible students, PII from education records to a third party to conduct 
certain types of studies for, or on behalf of, schools, school districts, or postsecondary 
institutions, including, in this context, studies to develop, validate, or administer predictive tests, 
such as the college admissions examinations (20 U.S.C. 1232g(b)(1)(F); 34 CFR § 99.31 (a)(6)). 
Under this exception, the disclosing entity must also enter into a written agreement with the 
third party containing the following information required under 34 CFR § 99.31 (a)(6)(iii)(C): 


- Specification of the purpose, scope, and duration of the study; 
- Specification of the Pll from education records to be disclosed; 


- Requirements for the organization conducting the study to only use the PIl for the 
specified purpose (which would not include the recruitment of students or scholarship 
solicitation by third party organizations), and to safeguard it from further disclosure and 
unauthorized use; and 


- Requirements that the organization conducting the study destroy the Pll when the 
information is no longer needed for the purpose of the study, along with a time period for 
the destruction. 
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School Official Exception 


Finally, LEAs that contract directly with the testing companies may also utilize FERPA’s school 
official exception to consent (20 U.S.C. 1232g(b)(1)(A); 34 CFR § 99.31 (a)(1)). Under the school 
official exception, the testing companies to which Pll contained in education records is disclosed, 
without the prior, written consent of parents or eligible students, must: 


- Perform an institutional service or function for which the LEA would otherwise use its 


own employees; 


- Meet the criteria set forth in the LEA’s annual notification of FERPA rights for being a 
school official with a legitimate educational interest in the education records; 


- Be under the direct control of the LEA with regard to the use and maintenance of the PIl 
from education records; and 


- Use the Pll from education records only for authorized purposes and not re-disclose the 
PIl to other parties (unless the LEA authorizes the testing companies to re-disclose the 
PIl to the third party organization and its re-disclosure to the third party organization is 
otherwise permitted by FERPA). 


Redisclosure Requires Consent under FERPA and IDEA 


Under all three of these exceptions to consent, the testing companies would generally be 
prohibited from re-disclosing Pll from students’ education records under FERPA and IDEA 
(including redisclosure to IHEs, scholarship organizations, and other organizations) without the 
prior, written consent of the parent or eligible student. 34 CFR §§ 99.31 (a)(1)(i)(B) (iii); 

99.31 (a)(6)(iii)(A); 99.33(a); and 99.35(a)(2)(ii) and (b)(1). 


Under the FERPA regulations, prior written consent must meet the following requirements, as 
specified in 34 CFR § 99.30: 


- The consent must be signed and dated (electronic signatures are acceptable, provided the 
identity of the parent or eligible student has been properly authenticated); 


- The consent must specify the records to be disclosed, the party or class of parties to 
whom the disclosure will be made, and the purpose for the disclosure; and 
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- The parent or eligible student must be permitted to revoke his or her consent for future 
disclosures. 


Under the IDEA Part B regulations, prior written consent must meet the following requirements, 
as specified in 34 CFR § 300.9: 


- The parent has been fully informed of all information relevant to the activity for which 
consent is sought, in his or her native language as defined, or through another mode of 
communication; 


- The parent understands and agrees in writing to the carrying out of the activity for which 
his or her consent is sought, and the consent describes that activity and lists the records 
(if any) that will be released and to whom; and 


- The parent understands that the granting of consent is voluntary on the part of the parent 
and may be revoked at any time. 


- Ifa parent revokes consent, that revocation is not retroactive (i.e., it does not negate an 
action that has occurred after the consent was given and before the consent was 
revoked). 


When contracting with the testing companies, SEAs, LEAs, and schools should specify in their 
contracts with the testing companies FERPA’s (and IDEA’s) prohibitions governing the 
unauthorized use of and re-disclosure of Pll from students’ education records (including any 
biographical or demographic information about the students provided by the SEA or LEA to the 
testing companies, and the students’ test scores or test score ranges). 


LEA Responsibilities under PPRA 


PPRA requires that LEAs develop and adopt policies, in consultation with parents, regarding, 
among other items, the right of parents to inspect, upon request, a survey created by a third party 
before the survey is administered or distributed by a school to students, and the procedure for 
granting a request by a parent for reasonable access to such survey within a reasonable period of 
time after the request is received (20 U.S.C. 1232h(c)(1)(A)).”7 Once these policies have been 
developed, the LEA must provide reasonable notice of the adoption or continued use of such 
policies directly to the parents of students enrolled in schools served by that agency (20 U.S.C. 
1232h(c)(2)(A)). At a minimum, the LEA must provide notice at least annually, at the beginning of 


° As is true under FERPA, IDEA also generally requires written parental consent prior to the disclosure of Pll from 
education records of eligible students with disabilities, and generally incorporates the FERPA exceptions to the 
prior written consent requirement. 34 CFR §300.622. 

’ The rights of parents under PPRA transfer to the student when the student turns 18 or is an emancipated minor 
under applicable State law (20 U.S.C. 1232h(c)(5)(B)). 
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the school year, and within a reasonable period of time after any substantive changes in such 
policies (20 U.S.C. 1232h(c)(2)(A)(i)). 


The LEA must also adopt policies to protect student privacy in the event of the administration or 
distribution of any survey containing questions that ask students to reveal information from one 
of the eight PPRA-protected areas® and also provide notification to parents, at least annually, at 
the beginning of the school year, of the specific or approximate dates during the school year when 
such a survey is scheduled or expected to be scheduled and an opportunity for parents to opt 
their students out of participation in any such survey (20 U.S.C. 1232h(c)(1)(B), (c)(2)(B), and 


(c)(2)(C)(ii)). 


As was previously stated, the testing companies include voluntary pre-test surveys in the testing 
packages that they provide to schools. These surveys currently include questions that ask 
students to reveal information concerning the following PPRA-protected categories: religious 
practices, affiliations, or beliefs of the student; and student and parental income.? The 
administration or distribution by an LEA of these pre-test surveys implicates PPRA, and the 
inclusion of questions on religion and income triggers the requirement in PPRA for parents to be 
notified of the opportunity to opt-out of having their children participate. 


State Privacy Protections 


As was mentioned above, several States have recently enacted student privacy statutes that 
provide additional protections beyond those provided under Federal law. We advise SEAs and 
LEAs to consult with their counsel regarding State law prior to contracting with a testing 
company to determine, among other things, whether there are additional rights afforded parents 
or eligible students in your State, or additional contractual requirements that must be included in 
your written agreements. 


8 The complete list of protected topics under PPRA includes: 

(i) Political affiliations or beliefs of the student or the student’s parent, 

(ii) Mental or psychological problems of the student or the student’s family, 

(iii) Sex behavior or attitudes, 

(iv) Illegal, anti-social, self-incriminating, or demeaning behavior, 

(v) Critical appraisals of other individuals with whom respondents have close family relationships, 

(vi) Legally recognized privileged or analogous relationships, such as those of lawyers, physicians, and ministers, 
(vii) Religious practices, affiliations, or beliefs of the student or the student’s parent, and 

(viii) Income (other than that required by law to determine eligibility for participation in a program or for receiving 
financial assistance under such program). 

20 U.S.C. 1232h(c)(1)(B) 

* College Board’s survey is available at https://collegereadiness.collegeboard.org/pdf/sat-registration-booklet- 
students.pdf. See question 31 (p.29) and 34 (p.31). 

ACT, Inc.’s survey is available at 
http://www.act.org/content/dam/act/unsecured/documents/Taking TheACTSandD.pdf. See question 59 (p.I 1) and 
62 (p.13). 
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Recommendations for SEAs and LEAs when Contracting with Testing Companies 


To address the legal issues identified above, PTAC encourages SEAs and LEAs to consider the 
following when contracting with testing companies: 


- Ensure that the contract with the testing companies specifies the FERPA exception under 
which PIl from students’ education records is to be disclosed to the testing company; 


- Include specific prohibitions in the contract governing unauthorized use of Pll and re- 
disclosure of PIl from education records (including biographic or demographic 
information provided by the SEA or LEA and students’ test scores or test score ranges) 
without written consent of the parent or eligible student; 


- Include specific requirements on how the testing companies should safeguard student PIl; 
and 


- Include any additional requirements that may be mandated by your State. 


Additional Recommendations for LEAs Relating to the Administration of the Pre-Test 
Surveys 


Because the pre-test surveys developed by the testing companies and administered or distributed 
by LEAs implicate PPRA, and as LEAs are responsible for meeting the requirements of PPRA, in 
addition to their requirements under FERPA and IDEA, LEAs are reminded to also consider the 
following: 


- Develop policies as required under PPRA in consultation with parents (and students 18 
years or older or who are emancipated) regarding the administration or distribution of 
surveys, notification of survey administration or distribution to parents and emancipated 
students, etc.; 


- Make pre-test survey questions available for review by parents and students, and available 
on the school or district’s website; a best practice would be to post them on the school 
or district’s website; 


- Asa best practice, be explicit with faculty, staff, parents, and students about the voluntary 
nature of the pre-test survey; 


- If the pre-test survey contains PPRA-protected topics, provide parents (and students 18 
or older or who are emancipated) with notice of the survey administration or distribution 
date and their right to opt out of taking the pre-test survey as required under PPRA; and 


- — If Pll from education records (including test scores or test score ranges) will be included 
in the information provided by the testing companies to third parties for college 
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recruiting purposes, obtain prior written consent as required under FERPA and IDEA 
from the parent or eligible student for the disclosure. 


Concluding Thoughts 


The Department recognizes the potential benefits to students of SEA and LEA administration of 
college admissions examinations. In addition to meeting SEA responsibilities under Title |, Part A 
of the ESEA, administration of these exams in schools may improve students’ opportunities for 
pursuing postsecondary education. Similarly, the pre-test surveys offered by the testing companies 
as part of the exam administration may provide parents and students with valuable opportunities 
to learn more about the postsecondary options available to them. This document is not intended 
to limit or hinder SEA or LEA administration of these exams or surveys but instead to provide 
helpful information regarding how administration of these exams and surveys may raise privacy 
issues under FERPA, IDEA, PPRA, and State law, and to remind SEAs and LEAs of their 
responsibilities under these Federal laws and to make recommendations for compliance. 


Additional Information 


Please contact PTAC (PrivacyTA@ed.gov) for additional information about protecting student 
privacy. 
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